T01 · Skill Instruction Hijacking
Error
- Location
- SKILL.md:23
- Finding
- Unaudited External Instructions Enable Skill Instruction Hijacking and Excessive Scope Expansion<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23`, `SKILL.md:32-39`; `README.md:7` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code `SKILL.md:23`: ```yaml installHint: "Tell your agent: set up skillboss.co/skill.md — or get API key at https://skillboss.co/console" ``` `SKILL.md:32-39`: ```markdown Tell your agent: ``` set up skillboss.co/skill.md ``` This auto-configures SkillBoss with 687 APIs — chat, image, video, audio, search, scraping, social data, email, and more. ``` `README.md:7`: ```markdown > 📖 **Complete setup guide**: https://skillboss.co/skill.md ``` ### Technical Analysis The skill explicitly instructs an agent to obtain and act on setup directions hosted at `skillboss.co/skill.md`. The effective setup instructions are therefore not contained in the audited package and can be changed independently after the package has been reviewed or installed. This creates an instruction-hijacking boundary: content controlled by an external service is presented as an action for the agent to perform under the authority of the installed skill. A later modification or compromise of the external document could introduce new instructions without requiring a change to this repository. The documented setup also expands the skill from its declared Claude API gateway purpose to automatic configuration for 687 APIs, including unrelated capabilities such as email, scraping, social data, image generation, video, and audio. This broad expansion violates least-privilege principles and increases both credential exposure and the number of third-party capabilities available to the agent. The repository does not contain the remote document, so its current contents and behavior cannot be verified by this audit. The vulnerability is the delegation of actionable agent setup to mutable, unaudited external instructions—not a claim that the current remote document contains executable malware. ### Attack ...[truncated 1696 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove directives telling agents to retrieve and execute setup instructions from `skillboss.co/skill.md`. 2. Include the complete setup procedure directly in the version-controlled `SKILL.md` file so that all effective instructions are available for review. 3. Restrict the default setup to the minimum capability required for the declared purpose: access to the documented Claude-compatible API endpoint. 4. Do not automatically configure unrelated email, scraping, social-data, image, video, or audio integrations. 5. Treat external documentation as informational only. Require the agent to display remote content to the user and obtain explicit approval before performing any action derived from it. 6. If an external artifact is technically unavoidable, use an immutable, versioned resource and verify it against a pinned cryptographic digest before use. 7. Enumerate every configuration change, credential destination, network endpoint, and required permission in the audited package. 8. Require separate, explicit user consent for each additional integration or capability rather than enabling hundreds of APIs through a single broad setup action. 9. Update `README.md` so that it links to documentation for human reference without characterizing the remote page as an executable or authoritative agent setup guide. ]]>